Skip to main content

#blue-team

Every article tagged “blue-team”, newest first.

Articles tagged blue-team

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read
A stack of thin dark glass layers seen edge-on, with one amber line running down through a glowing node on every layer

Best Practices

Incident Response Plan Template Mapped to NIST SP 800-61r3

Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.

Nerea Guallar16 min read
A sealed dark glass cube behind a translucent wall, with one thin amber thread passing through to light up a few dots on a grid

Best Practices

VirusTotal Alternatives: Check a File Without Uploading It

VirusTotal alternatives sorted by what they need from you: hash-only lookups, public sandboxes that publish your upload, and self-hosted tools.

Nicole Dobrovolskyy15 min read
Four dark glass cubes linked on a faint grid, with one amber pulse travelling between them and an amber glow where it lands

Tutorials

Cybersecurity Home Lab: Build One That Generates Alerts

Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.

Nerea Guallar13 min read
Three nested translucent glass frames with thin amber edges, each wider than the last, on a dark background

Best Practices

EDR vs Antivirus vs XDR: Key Differences for SOC Analysts

EDR vs antivirus vs XDR: what each one blocks and records, whether XDR is better than antivirus, and what SOC analysts can conclude from each alert.

Nicole Dobrovolskyy8 min read
Abstract dark illustration of three stacked translucent layers with a single amber line passing down through each one

Best Practices

SOC Tools by Tier: What T1, T2 and T3 Analysts Open First

SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.

Nerea Guallar14 min read
Abstract dark diagram of many dim branching paths with one amber route traced unbroken from left to right

Best Practices

SOC Playbook Template: Steps, Queries and Thresholds

Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.

Nicole Dobrovolskyy23 min read
Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree

Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid Lindqvist19 min read
Abstract dark illustration of numbered authentication paths converging on a single Windows security log entry

Tutorials

Windows Logon Types: A Triage Guide for Every 4624 Value

Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.

Astrid Lindqvist17 min read